EXECUTIVE SUMMARY:
macOS malware campaign has been identified, primarily involving the XCSSET malware family, which leverages fake applications, Xcode project infections, and Git hook persistence to compromise developer environments. The attack begins with the vectfd_xhh launcher module, which checks for Xcode or Git installations before deploying its payload. If neither is found, it defaults to Finder. The launcher installs a fake application that executes scripts stored in temporary directories, ensuring persistence and execution of malicious commands. Additionally, it attempts to bypass security measures by modifying TCC permissions and resets the database when needed.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
macOS malware campaign has been identified, primarily involving the XCSSET malware family, which leverages fake applications, Xcode project infections, and Git hook persistence to compromise developer environments. The attack begins with the vectfd_xhh launcher module, which checks for Xcode or Git installations before deploying its payload. If neither is found, it defaults to Finder. The launcher installs a fake application that executes scripts stored in temporary directories, ensuring persistence and execution of malicious commands. Additionally, it attempts to bypass security measures by modifying TCC permissions and resets the database when needed.[emaillocker id="1283"]
The malware specifically targets Xcode projects using the dfhsebxzod module, injecting payloads into project files through methods like RULE, TARGET, and FORCED_STRATEGY. It establishes persistence with the jez module by modifying Git pre-commit hooks, ensuring execution upon every commit. Several exfiltration modules are also present: uhsoxtfd_vostfd uploads files from a targeted directory, fpfb lists and uploads directory contents, and vectfd extracts specific file types. Some modules are still in development, as indicated by hardcoded test folders. The malware employs encoding techniques such as Base64 and xxd to obfuscate its payloads before execution, making detection more difficult.
This campaign demonstrates an advanced approach to persistence and evasion, using multiple attack vectors that primarily target developers. The use of infected Xcode projects, Git hooks, and fake applications ensures a high level of infiltration into development workflows. The malware’s ability to manipulate system permissions and execute payloads at various stages of application development increases its effectiveness. XCSSET’s modular design and ability to reset security settings allow it to establish long-term persistence while exfiltrating sensitive data to command-and-control (C2) servers.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Initial Access | T1195 | Supply Chain Compromise |
| Execution | T1059 | Command and Scripting Interpreter |
| Privilege Escalation | T1546 | Event Triggered Execution |
| T1548 | Abuse Elevation Control Mechanism | |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information |
| T1564 | Hide Artifacts | |
| T1070 | Indicator Removal | |
| T1027 | Obfuscated Files or Information | |
| T1222 | File and Directory Permissions Modification | |
| T1036 | Masquerading | |
| T1647 | Plist File Modification | |
| Discovery | T1518 | Software Discovery |
| T1082 | System Information Discovery | |
| T1614 | System Location Discovery | |
| T1217 | Browser Information Discovery | |
| T1033 | System Owner/User Discovery | |
| T1083 | File and Directory Discovery | |
| Collection | T1560 | Archive Collected Data |
| T1005 | Data from Local System | |
| Command and Control | T1105 | Ingress Tool Transfer |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
REFERENCES:
The following reports contain further technical details:
https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/